Read the docs
TI-2026-06838 Aliases CVE-2026-7763GHSA-wq9p-qhjj-gw6h

Heap buffer overflow in morse.ko TIM IE processing

Priority MEDIUM 50Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. The function morse_page_slicing_process_tim_element() in page_slicing.c derives the TIM bitmap length directly from a received IE field without validating it against the fixed-size destination buffer before passing it to memset and memcpy operations, allowing up to 252 bytes of attacker-controlled data to be written beyond the buffer boundary. Because beacons are broadcast frames processed during passive scanning, no authentication, association, or user interaction is required.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00536 45th percentileScored 2026-11-07
Fix Fixed HaLowLink 2 (Morse Micro): 2.11.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Morse MicroHaLowLink 2before 2.11.132.11.13Patch availableCNA
  • HaLowLink 2 VendorMorse Micro Affected before 2.11.13 Fixed in 2.11.13 Patch available CNA

Remediation

  • Fix · CNA HaLowLink 2 (Morse Micro) Fixed in 2.11.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Morse Micro HaLowLink 2 2.11.13

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-06837 Heap buffer overflow in dot11ah.ko S1G Capabilities IE processingPriority MEDIUM 50
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7763
  2. 2026-10-03 Alias added: GHSA-wq9p-qhjj-gw6h
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 1

  • TI-2026-06837 Heap buffer overflow in dot11ah.ko S1G Capabilities IE processing CVSS 3.1CRITICAL 9.8
  • TI-2026-06839 Out-of-bounds read in morse.ko Vendor IE processing CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences